ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Tracks / Traffic Analysis / Legacy Protocol

Legacy Protocol

Medium 25 pts

A backup job over FTP, a protocol from 1971 somehow still in production. The credentials are in the clear and they are a decoy. The flag is in what the session went on to transfer.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

Follow the stream on port 21 and read the commands. Note the filename it retrieves.

Hint 2

The contents are not on port 21. FTP negotiates a second connection — look at the PASV reply.

Hint 3

That reply encodes six numbers: port = (fifth × 256) + sixth. Follow that stream.

The capture

Forged on this server. Open it in Wireshark, or run tshark -r legacy.pcap.

Download legacy.pcap

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.